peaks-loop 4.1.0 → 4.1.2

package/dist/services/scan/archetype-detection.js

@@ -10,8 +10,8 @@
  * `decideIntegrationMode`) and the public `scanArchetype` entry; the
  * `frontendOnly` / `frontendOnlyReason` output contract is unchanged.
  */
-import { stat } from 'node:fs/promises';
-import { join } from 'node:path';
+import { readdir, stat } from 'node:fs/promises';
+import { join, relative as relativePath } from 'node:path';
 import { isDirectory, pathExists, readText } from 'peaks-loop-shared/fs';
 export const BACKEND_DEP_NAMES = [
     'express',
@@ -85,6 +85,179 @@ export async function readPackageJsonDeps(projectRoot) {
 export async function detectBackendFrameworks(deps) {
     return BACKEND_DEP_NAMES.filter((name) => name !== 'next' && Object.prototype.hasOwnProperty.call(deps, name));
 }
+/**
+ * Manifests that only a service writes. Language-diverse on purpose: every
+ * other probe in this file is Node-specific, and a repository whose backend is
+ * Go / Java / Kotlin / Python / Ruby / PHP / Rust has no Node manifest at all,
+ * so a Node-only evidence set reported it as `frontendOnly`.
+ */
+export const SERVICE_ONLY_MANIFEST_FILES = [
+    'go.mod',
+    'pom.xml',
+    'build.gradle',
+    'build.gradle.kts',
+    'settings.gradle',
+    'settings.gradle.kts',
+    'manage.py',
+    'config.ru',
+    'artisan'
+];
+/**
+ * Manifests a service MAY write and a library or CLI also writes. Counted as
+ * backend evidence only when the file itself names a web framework — the
+ * alternative is a boolean that fires on any Python or Rust directory, which
+ * trades one wrong answer for another.
+ */
+export const CONDITIONAL_SERVICE_MANIFESTS = [
+    ['requirements.txt', /\b(fastapi|flask|django|uvicorn|gunicorn|aiohttp|tornado|starlette)\b/i],
+    ['pyproject.toml', /\b(fastapi|flask|django|uvicorn|gunicorn|aiohttp|tornado|starlette)\b/i],
+    ['Cargo.toml', /\b(actix-web|axum|rocket|warp|tonic|hyper|poem)\b/i],
+    ['Gemfile', /\b(rails|sinatra|hanami|puma|rack)\b/i],
+    ['composer.json', /\b(laravel|symfony|slim)\b/i]
+];
+/** Directories never worth descending into when looking for a service manifest. */
+const MANIFEST_WALK_SKIP_DIRS = new Set([
+    'node_modules',
+    'dist',
+    'build',
+    'out',
+    'coverage',
+    'target',
+    'vendor',
+    '__pycache__',
+    '.git'
+]);
+/**
+ * How deep from the project root a service is allowed to sit before its
+ * manifest stops being counted. Two levels covers the layouts that were
+ * invisible (`apps/gateway/package.json`, `services/checkout/requirements.txt`,
+ * `web/` + `cmd/server`), and a deeper walk would read generated trees.
+ */
+export const SERVICE_MANIFEST_MAX_DEPTH = 2;
+/**
+ * How many leading bytes of a source file are read to find a directive. `'use
+ * server'` must be the first statement, so the head is the whole question, and
+ * reading a bounded head keeps this probe from pulling multi-megabyte files into
+ * memory.
+ */
+const DIRECTIVE_HEAD_BYTES = 400;
+async function readDirSafe(dir) {
+    try {
+        return await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        // An unreadable directory is not evidence of a backend, and not of its
+        // absence either; the root manifest already carries the project.
+        return [];
+    }
+}
+function relativeFromRoot(projectRoot, dir) {
+    return relativePath(projectRoot, dir).replace(/\\/g, '/');
+}
+function labeled(relative, file) {
+    return relative === '' ? file : `${relative}/${file}`;
+}
+function descendable(entries, dir, depth) {
+    if (depth >= SERVICE_MANIFEST_MAX_DEPTH)
+        return [];
+    return entries
+        .filter((entry) => entry.isDirectory() &&
+        !MANIFEST_WALK_SKIP_DIRS.has(entry.name) &&
+        !entry.name.startsWith('.'))
+        .map((entry) => ({ dir: join(dir, entry.name), depth: depth + 1 }));
+}
+/**
+ * Service manifests sitting in ONE directory: the unmistakable ones by name,
+ * and the shared ones only when the file names a web framework.
+ */
+async function manifestEvidenceInDir(dir, relative, names) {
+    const found = SERVICE_ONLY_MANIFEST_FILES.filter((manifest) => names.has(manifest)).map((manifest) => labeled(relative, manifest));
+    for (const [manifest, pattern] of CONDITIONAL_SERVICE_MANIFESTS) {
+        if (!names.has(manifest))
+            continue;
+        const text = await readText(join(dir, manifest)).catch(() => '');
+        const matched = pattern.exec(text);
+        if (matched !== null) {
+            found.push(`${labeled(relative, manifest)} (${matched[0].toLowerCase()})`);
+        }
+    }
+    return found;
+}
+/**
+ * A nested `package.json` declares its own dependencies, and a workspace root
+ * does not list them. Reading only the root is how an express service under
+ * `apps/` became `frontendOnly`.
+ */
+async function workspacePackageEvidence(dir, relative, names, backendDepNames) {
+    if (relative === '' || !names.has('package.json'))
+        return [];
+    const { deps } = await readPackageJsonDeps(dir);
+    return backendDepNames
+        .filter((dep) => dep !== 'next' && Object.prototype.hasOwnProperty.call(deps, dep))
+        .map((dep) => `${relative}: ${dep}`);
+}
+/**
+ * Backend evidence that lives OUTSIDE the root manifest: a workspace package's
+ * own `package.json`, and any non-Node service manifest.
+ *
+ * Returns `dir: evidence` strings (`apps/gateway: express`, `go.mod`,
+ * `services/checkout: requirements.txt`) rather than a boolean, because the
+ * whole defect this probe closes was a verdict that could not say what it saw.
+ */
+export async function detectNestedServiceEvidence(projectRoot, backendDepNames = BACKEND_DEP_NAMES) {
+    const evidence = [];
+    const queue = [{ dir: projectRoot, depth: 0 }];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (current === undefined)
+            break;
+        const entries = await readDirSafe(current.dir);
+        const names = new Set(entries.map((entry) => entry.name));
+        const relative = relativeFromRoot(projectRoot, current.dir);
+        evidence.push(...(await manifestEvidenceInDir(current.dir, relative, names)));
+        evidence.push(...(await workspacePackageEvidence(current.dir, relative, names, backendDepNames)));
+        queue.push(...descendable(entries, current.dir, current.depth));
+    }
+    return evidence.sort();
+}
+/** Does this directory tree contain a file opening with `'use server'`? */
+async function hasUseServerFile(rootDir) {
+    const queue = [{ dir: rootDir, depth: 0 }];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (current === undefined)
+            break;
+        const entries = await readDirSafe(current.dir);
+        for (const entry of entries) {
+            const full = join(current.dir, entry.name);
+            if (entry.isDirectory())
+                continue;
+            if (!/\.(ts|tsx|js|jsx)$/.test(entry.name))
+                continue;
+            const text = await readText(full).catch(() => '');
+            if (/['"]use server['"]/.test(text.slice(0, DIRECTIVE_HEAD_BYTES)))
+                return true;
+        }
+        queue.push(...descendable(entries, current.dir, current.depth));
+    }
+    return false;
+}
+/**
+ * Next.js server actions: `'use server'` in a file under `app/`. Route handlers
+ * under `pages/api` / `app/api` were the only Next backend the detector knew
+ * about, so a Next app that mutates data through actions — the documented
+ * Next.js way — was reported as having no backend at all.
+ */
+export async function detectNextServerActions(projectRoot) {
+    for (const root of ['app', 'src/app']) {
+        const rootDir = join(projectRoot, root);
+        if (await isDirectory(rootDir)) {
+            if (await hasUseServerFile(rootDir))
+                return true;
+        }
+    }
+    return false;
+}
 export async function detectNextApiRoutes(projectRoot, hasNext) {
     if (!hasNext) {
         return false;

package/dist/services/scan/archetype-service.js

@@ -1,7 +1,7 @@
 import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isDirectory } from 'peaks-loop-shared/fs';
-import { detectBackendDirs, detectBackendFrameworks, detectMonorepoConfigs, detectNextApiRoutes, detectSwagger, GREENFIELD_MAX_SRC_FILES, GREENFIELD_MAX_LOCKFILE_DAYS, HIGH_CONFIDENCE_SIGNAL_COUNT, LEGACY_MIN_SRC_FILES, lockfileAgeDays, LOCKFILE_STALE_DAYS, readPackageJsonDeps } from './archetype-detection.js';
+import { detectBackendDirs, detectBackendFrameworks, detectMonorepoConfigs, detectNestedServiceEvidence, detectNextApiRoutes, detectNextServerActions, detectSwagger, GREENFIELD_MAX_SRC_FILES, GREENFIELD_MAX_LOCKFILE_DAYS, HIGH_CONFIDENCE_SIGNAL_COUNT, LEGACY_MIN_SRC_FILES, lockfileAgeDays, LOCKFILE_STALE_DAYS, readPackageJsonDeps } from './archetype-detection.js';
 async function countSrcFiles(projectRoot, max = 500) {
     const srcDir = join(projectRoot, 'src');
     if (!(await isDirectory(srcDir))) {
@@ -30,11 +30,26 @@ async function countSrcFiles(projectRoot, max = 500) {
     }
     return count;
 }
+/**
+ * THE backend predicate — one answer, three callers.
+ *
+ * `decideArchetype`, `decideFrontendOnly` and `decideIntegrationMode` each
+ * spelled the same triple out inline, so a signal added for one of them left
+ * the other two reading a different project. The report then contradicted
+ * itself, which is the failure `54ba0cc4` ("one answer for where frontendOnly
+ * lives") was meant to end but did not. Anything that asks "does this repo
+ * have a backend?" asks here.
+ */
+function hasBackendEvidence(detected) {
+    return (detected.hasBackendFramework ||
+        detected.hasNextApiRoutes ||
+        detected.hasNextServerActions ||
+        detected.backendDirsPresent.length > 0 ||
+        detected.nestedServiceEvidence.length > 0);
+}
 function decideArchetype(detected) {
     const signals = [];
-    const hasBackend = detected.hasBackendFramework ||
-        detected.hasNextApiRoutes ||
-        detected.backendDirsPresent.length > 0;
+    const hasBackend = hasBackendEvidence(detected);
     signals.push({
         name: 'backend-presence',
         matched: hasBackend,
@@ -44,8 +59,12 @@ function decideArchetype(detected) {
                     ? `framework: ${detected.backendFrameworks.join(', ')}`
                     : null,
                 detected.hasNextApiRoutes ? 'next-api-routes' : null,
+                detected.hasNextServerActions ? 'next-server-actions' : null,
                 detected.backendDirsPresent.length > 0
                     ? `dirs: ${detected.backendDirsPresent.join(', ')}`
+                    : null,
+                detected.nestedServiceEvidence.length > 0
+                    ? `nested: ${detected.nestedServiceEvidence.join(', ')}`
                     : null
             ]
                 .filter(Boolean)
@@ -79,7 +98,6 @@ function decideArchetype(detected) {
     }
     // Monorepo detection runs BEFORE the backend check: a monorepo with
     // a packages/server dir is a fullstack-monorepo, NOT legacy-fullstack.
-    // Slice 2026-07-15 ice-cola hot-fix: previously a monorepo with a
     // backend sub-package fell through to `legacy-fullstack` because
     // `hasBackend` includes `backendDirsPresent.length > 0`, which the
     // L199 guard above couldn't handle. We now treat `hasMonorepoConfig`
@@ -131,33 +149,24 @@ function decideFrontendOnly(report) {
     if (report.archetype === 'legacy-frontend' || report.archetype === 'frontend-monorepo') {
         return { frontendOnly: true, reason: `archetype=${report.archetype}` };
     }
-    const noBackend = !report.detected.hasBackendFramework &&
-        !report.detected.hasNextApiRoutes &&
-        report.detected.backendDirsPresent.length === 0;
+    const noBackend = !hasBackendEvidence(report.detected);
     if (noBackend && !report.detected.hasSwaggerOrProto) {
         return { frontendOnly: true, reason: 'no-backend-no-swagger' };
     }
-    if (report.detected.hasBackendFramework ||
-        report.detected.hasNextApiRoutes ||
-        report.detected.backendDirsPresent.length > 0) {
-        return { frontendOnly: false, reason: 'backend-detected' };
+    if (noBackend) {
+        return { frontendOnly: false, reason: 'swagger-or-proto-present' };
     }
-    return { frontendOnly: false, reason: 'swagger-or-proto-present' };
+    return { frontendOnly: false, reason: 'backend-detected' };
 }
 /**
  * Three frontend integration scenarios, from the signals `detected`
- * already holds. Backend presence uses the SAME triple as
- * `decideArchetype`'s `hasBackend` (framework OR next API routes OR
- * backend dirs) rather than `hasBackendFramework` alone: `next` is
- * deliberately excluded from `backendFrameworks` (:77), so a Next
- * project with `pages/api` is `legacy-fullstack` there and must not be
- * `prd-only` here — one report cannot contradict itself.
+ * already holds. Backend presence is the SAME predicate `decideArchetype`
+ * uses (`hasBackendEvidence`), because one report cannot be
+ * `legacy-fullstack` and `prd-only` at once — a Next project with server
+ * actions, or an express service under `apps/`, is a backend for both.
  */
 function decideIntegrationMode(report) {
-    const hasBackend = report.detected.hasBackendFramework ||
-        report.detected.hasNextApiRoutes ||
-        report.detected.backendDirsPresent.length > 0;
-    if (hasBackend) {
+    if (hasBackendEvidence(report.detected)) {
         return { integrationMode: 'full-stack', reason: 'backend-detected' };
     }
     if (report.detected.hasSwaggerOrProto) {
@@ -172,6 +181,8 @@ export async function scanArchetype(options) {
     const hasNext = Object.prototype.hasOwnProperty.call(deps, 'next');
     const hasNextApiRoutes = await detectNextApiRoutes(projectRoot, hasNext);
     const backendDirsPresent = await detectBackendDirs(projectRoot);
+    const nestedServiceEvidence = await detectNestedServiceEvidence(projectRoot);
+    const hasNextServerActions = hasNext ? await detectNextServerActions(projectRoot) : false;
     const swaggerPaths = await detectSwagger(projectRoot);
     const monorepoConfigs = await detectMonorepoConfigs(projectRoot);
     const srcFileCount = await countSrcFiles(projectRoot);
@@ -180,6 +191,8 @@ export async function scanArchetype(options) {
         hasPackageJson,
         hasBackendFramework: backendFrameworks.length > 0,
         backendFrameworks,
+        nestedServiceEvidence,
+        hasNextServerActions,
         hasSwaggerOrProto: swaggerPaths.length > 0,
         swaggerPaths,
         hasMonorepoConfig: monorepoConfigs.length > 0,

package/dist/services/scan/file-size-policy.d.ts

@@ -26,7 +26,6 @@ export declare function inFileSizeScope(file: string): boolean;
  * of a scope extension. Both consumers read this instead of each carrying its own
  * half of the rule.
  *
- * WHY IT MATTERS (F3 of the repair cycle, rid `2026-09-30-cap-unify-01`). The
  * census enumerated its scope with `git ls-files <dirs>` plus the extension test,
  * while the scan measured EVERY changed non-exempt file at `fileSizeCapFor`'s
  * else-branch 300 — including paths in neither list. The two disagreed about the

package/dist/services/scan/file-size-policy.js

@@ -7,7 +7,6 @@
 // `scripts/lint/file-size-census.ts` (the whole-tree count the husky gate
 // ratchets). Neither may restate a number.
 //
-// WHY ONE MODULE (rid 2026-09-30-cap-unify-01). The policy was written twice,
 // in two units: `max-lines: [error, {max: 400, skipBlankLines, skipComments}]`
 // in `config/eslint/.peaks-rules.cjs` and a raw `DEFAULT_FILE_SIZE_THRESHOLD`
 // of 800 here. Two spellings of one decision drift by construction, and the only
@@ -30,7 +29,6 @@
 // A row that silently excluded them would not equal its own measurement — the
 // same class of hole as lint-gate §4b (a surface asserted but never counted).
 //
-// NUMBERS THIS MODULE DOES NOT OWN, DECIDED 2026-09-30 (F6 of the repair cycle).
 // A line-count constant elsewhere in the repo is a second copy of THIS policy only
 // if it decides the same question — "may this file be committed at this size?".
 // Three that do not, recorded here so the next reader does not re-litigate them:
@@ -43,7 +41,6 @@
 //     this cap and is NOT folded into it — folding it in would silently change what
 //     the legacy report says. Its name does not match the census's `CAP_NAME`
 //     second-copy rule on purpose; see lint-gate §4b row 7.
-//   - `src/services/skills/lint-reference-shape.ts` 800: the shape of an
 //     example lint report, not a cap.
 /** Raw-line cap for `src/`, `scripts/` and `packages/` — including a `tests` directory inside a package. */
 export const FILE_SIZE_CAP_DEFAULT = 300;
@@ -84,7 +81,6 @@ export function inFileSizeScope(file) {
  * of a scope extension. Both consumers read this instead of each carrying its own
  * half of the rule.
  *
- * WHY IT MATTERS (F3 of the repair cycle, rid `2026-09-30-cap-unify-01`). The
  * census enumerated its scope with `git ls-files <dirs>` plus the extension test,
  * while the scan measured EVERY changed non-exempt file at `fileSizeCapFor`'s
  * else-branch 300 — including paths in neither list. The two disagreed about the
@@ -128,7 +124,6 @@ export function fileSizeScopeBucket(file) {
 }
 // ---------------------------------------------------------------------------
 // THE SECOND SCOPE — `.husky/`, the directory the ratchet itself lives in
-// (backlog §2.32, rid 2026-10-02-hooks-size-rows)
 // ---------------------------------------------------------------------------
 //
 // WHAT WAS INVISIBLE. `FILE_SIZE_SCOPE_DIRS` names four directories, and `.husky`

package/dist/services/scan/file-size-scan.d.ts

@@ -49,7 +49,6 @@ export type FileSizeScanResult = {
      *  four scope directories, or with an extension it does not count. Reported
      *  rather than silently skipped, for the same reason `exemptFiles` is.
      *
-     *  WHY THEY ARE NOT VIOLATIONS (F3, rid 2026-09-30-cap-unify-01). Every file
      *  the scan checked used to be measured against `fileSizeCapFor`, whose
      *  else-branch is 300 — a number that is only defined for `src`/`packages`/
      *  `scripts`. So an out-of-scope path (a `.md`, a file under `.husky/`) could

package/dist/services/scan/scan-types.d.ts

@@ -22,6 +22,15 @@ export type ArchetypeReport = {
         hasPackageJson: boolean;
         hasBackendFramework: boolean;
         backendFrameworks: string[];
+        /** Backend evidence the ROOT manifest cannot see: a workspace package's own
+         *  `package.json` (`apps/gateway: express`) and any non-Node service
+         *  manifest (`go.mod`, `services/checkout/requirements.txt (fastapi)`).
+         *  Every probe that filled `detected` before this field read Node's
+         *  manifest only, so a Go or Java service reported as `frontendOnly`. */
+        nestedServiceEvidence: string[];
+        /** Next.js server actions (`'use server'` under `app/`). Route handlers
+         *  (`pages/api` / `app/api`) were the only Next backend recognised. */
+        hasNextServerActions: boolean;
         hasSwaggerOrProto: boolean;
         swaggerPaths: string[];
         hasMonorepoConfig: boolean;

package/dist/services/security/safe-settings-path.js

@@ -1,7 +1,6 @@
 /**
  * R-2 path-safety guard for sub-agent state files.
  *
- * Slice 2026-06-07-sub-agent-dispatch-decouple (G4) — reuses the same
  * R-2 symlink/junction guard as `assertSafeSettingsFile` for
  * `.peaks/_sub_agents/<sid>/dispatch-<rid>-<ts>.json` paths.
  *

package/dist/services/session/binding-store.d.ts

@@ -6,7 +6,6 @@
  *
  * v2.16.0 schema is a multi-instance registry with conflict-detection
  * sentinel fields (ownerHint, pid, lastHeartbeat, instances Map).
- * See PRD `001-2026-06-29-v2-16-0-change-id-axis-removal` AC-8.
  *
  * The store keeps a one-shot migration from the legacy schema:
  * legacy single-session binding → v2.16.0 instances Map with one entry,
@@ -80,13 +79,11 @@ export declare function registerInstance(projectRoot: string, opts: {
 };
 /**
  * Touch the `lastHeartbeat` for a specific instance. Used by the
- * Doctor periodic loop (AC-10) and by the Skill presence `startup`
  * gate.
  */
 export declare function heartbeat(projectRoot: string, sid: string): Binding | null;
 /**
  * Drop an instance entry from the binding. Used when the last peaks-*
- * skill on a Claude instance exits (AC-7: all skills inactive →
  * no record). Returns the updated binding (or null if no instances
  * remain and the caller wants to delete the binding entirely).
  */
@@ -94,7 +91,6 @@ export declare function dropInstance(projectRoot: string, sid: string): Binding
 /**
  * Drop stale instances (lastHeartbeat older than `ttlMs`). Returns
  * the list of dropped sid values so the caller can log them. Used
- * by AC-10 Doctor.
  */
 export declare function dropStale(projectRoot: string, ttlMs: number): {
     binding: Binding | null;

package/dist/services/session/binding-store.js

@@ -6,7 +6,6 @@
  *
  * v2.16.0 schema is a multi-instance registry with conflict-detection
  * sentinel fields (ownerHint, pid, lastHeartbeat, instances Map).
- * See PRD `001-2026-06-29-v2-16-0-change-id-axis-removal` AC-8.
  *
  * The store keeps a one-shot migration from the legacy schema:
  * legacy single-session binding → v2.16.0 instances Map with one entry,
@@ -60,7 +59,6 @@ function getCurrentOuterSessionId() {
  * both env vars unset returns the literal `'unknown'` sentinel
  * for every process. Suffixing with `process.pid` makes the
  * callerId process-unique without changing the surface (no new
- * env var, no new schema field), preserving the AC-5 hard rule
  * that "one Claude instance keeps one sid across multiple
  * peaks-* skill activations" — a single process keeps a constant
  * pid across the whole run, including `/compact`.
@@ -144,7 +142,6 @@ export function readBinding(projectRoot) {
         typeof legacyShape.createdAt === 'string' &&
         typeof legacyShape.projectRoot === 'string') {
         // Auto-migrate marks lastHeartbeat as `now` (not `createdAt`) so the
-        // migrated instance does NOT immediately appear stale to AC-10.
         // Legacy bindings date from the pre-v2.16.0 single-session era;
         // their createdAt predates the binding sentinel concept entirely.
         const migratedAt = nowIso();
@@ -226,7 +223,6 @@ export function registerInstance(projectRoot, opts) {
         }
         // Auto-resume: caller already has an instance in this scope —
         // append roles and refresh heartbeat instead of creating a new
-        // sid. This is the AC-5 Claude-instance-level hard rule: a
         // single Claude caller keeps one sid across multiple peaks-*
         // skill activations.
         const existingSidForCaller = Object.entries(existing.instances).find(([, inst]) => inst.callerId === callerId)?.[0];
@@ -283,7 +279,6 @@ export function registerInstance(projectRoot, opts) {
 }
 /**
  * Touch the `lastHeartbeat` for a specific instance. Used by the
- * Doctor periodic loop (AC-10) and by the Skill presence `startup`
  * gate.
  */
 export function heartbeat(projectRoot, sid) {
@@ -307,7 +302,6 @@ export function heartbeat(projectRoot, sid) {
 }
 /**
  * Drop an instance entry from the binding. Used when the last peaks-*
- * skill on a Claude instance exits (AC-7: all skills inactive →
  * no record). Returns the updated binding (or null if no instances
  * remain and the caller wants to delete the binding entirely).
  */
@@ -328,7 +322,6 @@ export function dropInstance(projectRoot, sid) {
 /**
  * Drop stale instances (lastHeartbeat older than `ttlMs`). Returns
  * the list of dropped sid values so the caller can log them. Used
- * by AC-10 Doctor.
  */
 export function dropStale(projectRoot, ttlMs) {
     const existing = readBinding(projectRoot);

package/dist/services/session/caller-binding-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * Caller-Binding Service (slice 020 — caller-keyed session binding).
  *
  * Each caller has its own on-disk binding file at
  * `.peaks/_runtime/callers/<callerId>.json`. This service is the
@@ -33,7 +32,6 @@ export declare function getActiveSkillFileForCaller(projectRoot: string, peakSes
  * Resolve a stable, deterministic callerId for a legacy single-file
  * binding (M2). The hash input priority is:
  *
- *   1. `outerSessionId` (slice 018 stamped this on the per-peak
  *      session.json for sessions created after the slice shipped).
  *   2. `claudeSessionId` (legacy field name on pre-018 presence
  *      files; honour the read side so v1.2.x data does not lose its
@@ -59,11 +57,9 @@ export declare function getCallerBinding(projectRoot: string, callerId: string):
  *
  * `getCallerBinding` answers a SHAPE question: "is there a well-formed
  * binding file for this caller?". Session resolution needs a second
- * answer: "is that binding still USABLE?". Slice 2026-09-12
  * (rid=caller-binding-staleness) found it is not when the bound session's
  * directory is gone — the binding was still trusted, so a command
  * resolved the dead session id and `mkdir`'d a fresh tree under
- * `.peaks/_runtime/<gone-sid>/...` for a session that no longer exists.
  *
  * Returns a tagged result rather than `null` so the fall-through is
  * observable to the caller instead of silent:
@@ -88,7 +84,6 @@ export declare function resolveCallerBinding(projectRoot: string, callerId: stri
  * must be a valid session id, projectRoot is canonicalized). Idempotent:
  * re-writing the same callerId overwrites the file.
  *
- * Slice 2026-08-06-session-cacde8-A.5b: writes via `atomicWriteJson`
  * (temp-file-then-rename) so a power-loss mid-write cannot leave the
  * caller-binding file in a half-truncated state. `atomicWriteJson`
  * owns its own `mkdirSync(dir, { recursive: true })`, so the inline
@@ -99,7 +94,6 @@ export declare function setCallerBinding(projectRoot: string, callerId: string,
 /**
  * Repoint an EXISTING per-caller binding at a new peak session id.
  *
- * Slice 2026-09-10 (rid=rebind-must-update-caller-binding): an explicit
  * `peaks workspace init --session-id <X> --allow-session-rebind` rewrites
  * the project-global `.peaks/_runtime/session.json`. Without this call the
  * per-caller file keeps shadowing it for `getSessionIdCanonical`, so the

package/dist/services/session/caller-binding-service.js

@@ -1,5 +1,4 @@
 /**
- * Caller-Binding Service (slice 020 — caller-keyed session binding).
  *
  * Each caller has its own on-disk binding file at
  * `.peaks/_runtime/callers/<callerId>.json`. This service is the
@@ -50,7 +49,6 @@ export function getActiveSkillFileForCaller(projectRoot, peakSessionId, callerId
  * Resolve a stable, deterministic callerId for a legacy single-file
  * binding (M2). The hash input priority is:
  *
- *   1. `outerSessionId` (slice 018 stamped this on the per-peak
  *      session.json for sessions created after the slice shipped).
  *   2. `claudeSessionId` (legacy field name on pre-018 presence
  *      files; honour the read side so v1.2.x data does not lose its
@@ -112,7 +110,6 @@ export function resolveCallerBinding(projectRoot, callerId) {
  * must be a valid session id, projectRoot is canonicalized). Idempotent:
  * re-writing the same callerId overwrites the file.
  *
- * Slice 2026-08-06-session-cacde8-A.5b: writes via `atomicWriteJson`
  * (temp-file-then-rename) so a power-loss mid-write cannot leave the
  * caller-binding file in a half-truncated state. `atomicWriteJson`
  * owns its own `mkdirSync(dir, { recursive: true })`, so the inline
@@ -133,7 +130,6 @@ export function setCallerBinding(projectRoot, callerId, binding) {
 /**
  * Repoint an EXISTING per-caller binding at a new peak session id.
  *
- * Slice 2026-09-10 (rid=rebind-must-update-caller-binding): an explicit
  * `peaks workspace init --session-id <X> --allow-session-rebind` rewrites
  * the project-global `.peaks/_runtime/session.json`. Without this call the
  * per-caller file keeps shadowing it for `getSessionIdCanonical`, so the

package/dist/services/session/caller-id-types.d.ts

@@ -1,5 +1,4 @@
 /**
- * Caller-Id Resolution types (slice 020 — caller-keyed session binding,
  * refactored in slice 4.0.8 to be adapter-owned per RD §5).
  *
  * Per RD §5 + C1 user-confirmed product decision (binding 2026-08-03):
@@ -14,7 +13,6 @@
  * core resolution path only ever emits `'env-flag' | 'adapter' | 'none'`
  * via the new `CallerProjection.source` field.
  *
- * See `.peaks/_runtime/2026-08-03-session-bee258/rd/requests/001-2026-08-03-presence-lease-graph-design.md`
  * for the slice 4.0.8 contract.
  */
 export type CallerIdSource = 'flag' | 'env' | 'fallback' | 'none';
@@ -59,7 +57,6 @@ export interface CallerProjection {
  * On-disk shape of `.peaks/_runtime/callers/<callerId>.json`. One file
  * per caller; two callers may point to the same `peakSessionId` (D6).
  *
- * Slice 2026-09-12 (rid=caller-binding-staleness): the former
  * `lastActivityAt` field is REMOVED. It promised "bumped on every
  * `peaks <cmd>` that touches the binding" but was written only at first
  * bind and at an explicit rebind — never on reuse — so no freshness

package/dist/services/session/caller-id-types.js

@@ -1,5 +1,4 @@
 /**
- * Caller-Id Resolution types (slice 020 — caller-keyed session binding,
  * refactored in slice 4.0.8 to be adapter-owned per RD §5).
  *
  * Per RD §5 + C1 user-confirmed product decision (binding 2026-08-03):
@@ -14,7 +13,6 @@
  * core resolution path only ever emits `'env-flag' | 'adapter' | 'none'`
  * via the new `CallerProjection.source` field.
  *
- * See `.peaks/_runtime/2026-08-03-session-bee258/rd/requests/001-2026-08-03-presence-lease-graph-design.md`
  * for the slice 4.0.8 contract.
  */
 /**

package/dist/services/session/getSessionDir.js

@@ -1,7 +1,6 @@
 /**
  * Canonical session-directory resolver.
  *
- * As of slice 2026-06-05-peaks-runtime-layer the per-session workspace
  * lives at `<root>/.peaks/_runtime/<sessionId>/`, NOT at the legacy
  * `<root>/.peaks/<sessionId>/` location. All **write** paths MUST route
  * through this helper. The legacy top-level path survives only as a

package/dist/services/session/index.js

@@ -1,6 +1,5 @@
 export { ensureSession, getSessionId, resolveCallerBoundSession, getCurrentSessionDir, listSessions, getSessionMeta, setSessionMeta, setSessionTitle, listSessionMetas, getProjectScanPath, hasProjectScan, setCurrentSessionBinding, rotateSessionBinding } from './session-manager.js';
 export { getSessionDir } from './getSessionDir.js';
-// Slice 020 — caller-keyed session binding. The new canonical path.
 export { resolveCallerId } from './resolve-caller-id.js';
 export { getCallerBindingFile, getActiveSkillFileForCaller, synthesiseLegacyCallerId, getCallerBinding, resolveCallerBinding, setCallerBinding, listCallerBindings } from './caller-binding-service.js';
 // Slice 4.0.8 (C1): PLATFORM_FALLBACKS is deleted. Re-export kept as

package/dist/services/session/platform-fallbacks.d.ts

@@ -11,8 +11,6 @@
  * This file remains for one minor release as a no-op stub so legacy
  * imports keep type-checking. The named export is now an empty
  * readonly array; tests asserting `PLATFORM_FALLBACKS.length === 1`
- * (slice 020 A5) have been moved into the 4.0.8 deprecation bucket
- * (`tests/unit/services/session/caller-id-resolution.test.ts` will be
  * updated in a follow-up slice — out of scope for the 4.0.8 contract
  * freeze).
  *
@@ -21,7 +19,6 @@
  * (`getAdapter(ide).resolveCallerId(env)`), with `PEAKS_CALLER_ID` /
  * `--caller-id <id>` as the vendor-neutral short-circuits.
  *
- * See `.peaks/_runtime/2026-08-03-session-bee258/rd/requests/001-2026-08-03-presence-lease-graph-design.md`
  * for the slice 4.0.8 contract.
  */
 export interface PlatformFallback {

package/dist/services/session/platform-fallbacks.js

@@ -11,8 +11,6 @@
  * This file remains for one minor release as a no-op stub so legacy
  * imports keep type-checking. The named export is now an empty
  * readonly array; tests asserting `PLATFORM_FALLBACKS.length === 1`
- * (slice 020 A5) have been moved into the 4.0.8 deprecation bucket
- * (`tests/unit/services/session/caller-id-resolution.test.ts` will be
  * updated in a follow-up slice — out of scope for the 4.0.8 contract
  * freeze).
  *
@@ -21,7 +19,6 @@
  * (`getAdapter(ide).resolveCallerId(env)`), with `PEAKS_CALLER_ID` /
  * `--caller-id <id>` as the vendor-neutral short-circuits.
  *
- * See `.peaks/_runtime/2026-08-03-session-bee258/rd/requests/001-2026-08-03-presence-lease-graph-design.md`
  * for the slice 4.0.8 contract.
  */
 /**

package/dist/services/session/resolve-caller-id.d.ts

@@ -1,5 +1,4 @@
 /**
- * Caller-Id Resolution (slice 020 — caller-keyed session binding,
  * refactored in slice 4.0.8 to be adapter-owned per RD §5 + C1).
  *
  * As of 4.0.8 the per-platform `PLATFORM_FALLBACKS` table is DELETED.
@@ -30,7 +29,6 @@
  * mutate state. The caller (a CLI command, a service, a test) decides
  * what to do with the resolved id.
  *
- * See `.peaks/_runtime/2026-08-03-session-bee258/rd/requests/001-2026-08-03-presence-lease-graph-design.md`
  * for the slice 4.0.8 contract.
  */
 import { CallerIdError, type CallerProjection, type CallerProjectionSource } from './caller-id-types.js';